I have been using FreeBSD for quite some time. Now I want to dive into OpenBSD some more. Currently I'm trying to figure out what is the "recommended" way to keep my system up-to-date.

On FreeBSD, we use the command pkg upgrade to update all the installed packages to the latest version. And we use the command freebsd-update to fetch/install the latest patches for the "base" system (kernel). So, I think with pkg upgrade && freebsd-update I'm pretty much safe.

Now: What is the equivalent procedure on OpenBSD? I think that pkg_add -u on OpenBSD does pretty much the same as pkg upgrade on FreeBSD, i.e. it updates all the installed packages to the latest version. But what about an equivalent to freebsd-update ? So far I found sysupgrade on OpenBSD, but it is giving me "404 Not Found" errors every time. I think this is OpenBSD's way of telling me that, at this time, there is no newer release that I can upgrade to. Fair enough!

But how to get security patches for the "base" system of the OpenBSD release that I'm currently running? Does such thing even exist for OpenBSD, or do I have to wait for new release? 😲

Thank you!

2 Answers 2


You are correct that sysupgrade(8) replies with a 404 error when there are no new releases. That tool is the proper tool to use when upgrading your system to the next release or the latest snapshot release. Using pkg_add -u is also sufficient to update all installed packages (possibly followed up with pkg_delete -a to delete no longer needed packages).

Security patches, etc., are installed using syspatch(8). You may want to run syspatch -c as a daily cron job to be informed about new patches as they arrive. Snapshot systems do not use syspatch.

See also the OpenBSD FAQ, especially the section on Security Updates, and the OpenBSD 7.1 errata page.

The only ingredient missing from the above mix is the package sysclean. Once installed with pkg_add, you may use it to find files on the system that are no longer distributed as part of the base system and are also no longer in use by installed packages.

Study the manual for how to make sysclean ignore your own local additions to the system, and make sure not to trust the tool blindly (e.g. don't write automated jobs that delete stuff based on its output).

  • 1
    syspatch it is then. I see!
    – c4p1
    Apr 25 at 14:24
  • @c4p1 Also see the last bit of the answer, which I added after you accepted.
    – Kusalananda
    Apr 25 at 15:23
  • Okay, I will check syslcean too.
    – c4p1
    Apr 25 at 15:41

Just a minor addition to Kusalananda's answer: when installing OpenBSD you have to choose whether you want to follow -stable or -current aka "snapshot" [1]. You choose one by selecting the appropriate installation image from the project's mirrors.

If you are following -stable, sysupgrade will take you from one release to the next, e.g. from 7.0 to 7.1. You can keep it up to date by using syspatch to install the patches that are judged relevant enough to warrant a change to -stable. Occasionally, some -stable packages might also be updated, which can be done with pkg_add -u.

If you are following -current, sysupgrade will take you from one snapshot to the next, which are released at much shorter intervals. In this scenario there is no point on running syspatch, since the patches to -stable are already incorporated on the snapshots. Packages are updated much more frequently on current, so you'll probably want to run pkg_add -u after upgrading.

Due to the way OpenBSD's release process works, for short periods of time, right before a new release, -current snapshots will start carrying the tag of the upcoming release (e.g., changing from 7.0-current to 7.1) which makes the upgrade tools believe that the -current system is actually a -stable one. pkg_add -u will then look for packages under the new release's version directory on the mirrors (e.g. /pub/OpenBSD/7.1/), although that directory doesn't exist yet. This might also be a reason for 404 errors when updating.

[1]: To be pedantic, -current is to be taken literally, and refers to the actual state of the CVS tree. "Snapshots" are entire builds (base system and packages) made at specific points in time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.